84f85aa0fabab28188ef47f730fac55eabf841ce65f657155ba5efd5274a5ac9

Analysis

max time kernel
178s
max time network
197s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 13:47

Target

84f85aa0fabab28188ef47f730fac55eabf841ce65f657155ba5efd5274a5ac9.exe
Size

66KB
MD5

bff6f8174edd06b7c02a8a34d3cf3e91
SHA1

b6372ce38eed5cace0a43148e38ad5590a4602f2
SHA256

84f85aa0fabab28188ef47f730fac55eabf841ce65f657155ba5efd5274a5ac9
SHA512

ef66228c16c64e47da4c77002b5ea453da4f4ac1529f93a0c5a17ac308aa0c671e04bd59d11dbe71e5327ba72bc1e09550663dc1efdf661a2bab2788bdee19bf
SSDEEP

1536:R1s9gsCIJb36uzOW9J3qsHdlwcIxulEbgVD+Gt8QcEG:rUpxOuzxCsHn0uaocQP

Score

5^/10

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

84f85aa0fabab28188ef47f730fac55eabf841ce65f657155ba5efd5274a5ac9.exe

pid process

3400 84f85aa0fabab28188ef47f730fac55eabf841ce65f657155ba5efd5274a5ac9.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

668 3400 WerFault.exe 84f85aa0fabab28188ef47f730fac55eabf841ce65f657155ba5efd5274a5ac9.exe

pid	process
3400	84f85aa0fabab28188ef47f730fac55eabf841ce65f657155ba5efd5274a5ac9.exe

pid	pid_target	process	target process
668	3400	WerFault.exe	84f85aa0fabab28188ef47f730fac55eabf841ce65f657155ba5efd5274a5ac9.exe

C:\Users\Admin\AppData\Local\Temp\84f85aa0fabab28188ef47f730fac55eabf841ce65f657155ba5efd5274a5ac9.exe
"C:\Users\Admin\AppData\Local\Temp\84f85aa0fabab28188ef47f730fac55eabf841ce65f657155ba5efd5274a5ac9.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3400 -s 744
2⤵
- Program crash
PID:668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3400 -ip 3400
1⤵
PID:2356

memory/3400-132-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/3400-133-0x00000000022F0000-0x00000000023CB000-memory.dmp

Filesize
876KB

Download
memory/3400-134-0x00000000022F0000-0x00000000023CB000-memory.dmp

Filesize
876KB

Download